A FortiSwitch Access Control List (ACL) can process traffic that matches its rules in several ways. Two fundamental actions are dropping the traffic and redirecting it. The deny action explicitly instructs the FortiSwitch to discard the matching frames, preventing them from being forwarded. The mirror action sends a copy of the matching frames to a specified port, which is a form of redirection used for traffic analysis or monitoring. Both deny (drop) and mirror (redirect) are configurable actions directly within a FortiSwitch ingress ACL entry.

B. Assign traffic to a high-priority egress queue. This is a Quality of Service (QoS) function. While an ACL is used to classify traffic for a QoS policy, the ACL action itself is permit; the queue assignment is configured separately in the QoS policy that references the ACL.

C. Encrypt frames. Frame encryption is handled by specific security protocols like MACsec, which is configured on a per-port basis and is not a direct action available within a standard FortiSwitch ACL rule.

1. FortiSwitchOS 7.6.0 Administration Guide, Page 111, "Configuring an IPv4 ACL".

The guide details the CLI commands for configuring an ingress ACL. Under the config entries section for an ACL, the set action command is shown with the available parameters: set action {deny | permit | mirror}.

deny corresponds to option D (Drop frames).

mirror corresponds to option A (Redirect frames to another port, specifically for monitoring purposes).

2. FortiSwitch 7.6.0 Security Guide, Page 21, "Access control lists".

This document also confirms the available actions for ingress ACLs: "The following actions are available for ingress ACLs: permit, deny, mirror." This reinforces that dropping (deny) and redirecting/copying (mirror) are valid actions, while queue assignment and encryption are not direct ACL actions.